win37 Privacy Policy

1 Introduction

1.1 win37 ("we", "us", "our") operates the online gaming platform accessible at win37.bio (the "Platform"). We are committed to protecting the privacy and personal data of every individual who interacts with our services, including registered members, prospective players, and visitors to our website.

1.2 This Privacy Policy sets out the basis on which we collect, use, store, disclose, and otherwise process personal data in connection with the operation of the Platform. It applies to all data collected via the win37 website, account registration flows, customer support interactions, and payment processing channels.

1.3 This policy should be read alongside our Terms & Conditions and our Responsible Gaming guidelines, all of which form part of the overall framework governing your relationship with win37.

1.4 We may update this Privacy Policy from time to time. Material changes will be communicated to registered members via the email address on file. Continued use of the Platform after the effective date of any revision constitutes acceptance of the updated policy.

2 Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, location data, IP address, and any other data that can directly or indirectly identify an individual.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — win37, as the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — any third party that processes Personal Data on win37's behalf and under win37's documented instructions.
• "Member" — a natural person who has completed registration and holds an active account on the Platform.
• "KYC Data" — identity and address verification documents submitted in connection with the Know Your Customer compliance process.
• "Cookies" — small text files placed on your device by the Platform to enable functionality, session management, and analytics.
• "Sensitive Data" — a subset of Personal Data warranting heightened protection, including financial account details, government-issued identification numbers, and health-related information submitted in the context of responsible gaming.

3 Data We Collect

3.1 win37 collects the following categories of Personal Data in the course of providing its services:

3.2 win37 does not intentionally collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, or biometric data) beyond what is strictly necessary for identity verification purposes.

4 How We Collect Data

4.1 Directly from you: The majority of Personal Data we hold is provided directly by you during account registration, KYC submission, deposit or withdrawal requests, customer support interactions, and when you update your account profile.

4.2 Automatically: When you visit or interact with the Platform, we automatically collect Technical Data and Usage Data through server logs, cookies, and similar tracking technologies. This data is collected whether or not you are logged in to your account.

4.3 From third parties: We may receive Personal Data from third-party service providers engaged to verify your identity (KYC partners), process your payments (bank and e-wallet processors), or detect fraudulent activity (fraud-prevention platforms). Data received from third parties is handled under the same standards described in this policy.

4.4 From public sources: In certain fraud investigation or compliance contexts, win37 may cross-reference Personal Data against publicly available sources or sanctioned-persons databases maintained by competent international authorities.

5 Purposes of Processing

5.1 win37 processes your Personal Data for the following purposes:

• Account management: Creating, maintaining, and securing your Member account, including authentication and password recovery.
• Service delivery: Enabling you to place bets, play games, and access all Platform features in Indonesian Rupiah (IDR).
• Payment processing: Facilitating deposits via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OCBC NISP, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and processing withdrawal requests to your registered payment method.
• KYC and compliance: Verifying your identity and age (21+), detecting and preventing money laundering, fraud, and other illegal activity in line with international gaming compliance standards.
• Customer support: Responding to your enquiries, resolving disputes, and administering complaint procedures.
• Responsible gaming: Monitoring play patterns, enforcing self-exclusion and deposit limit requests, and proactively identifying members who may be experiencing gambling-related harm.
• Platform security: Detecting, preventing, and investigating security incidents, account takeovers, and fraudulent transactions.
• Analytics and improvement: Understanding how members use the Platform in aggregate to improve the user experience, game selection, and payment options.
• Legal obligations: Retaining records and responding to requests from regulatory authorities, law enforcement, and courts as required by applicable law.
• Marketing communications: Sending promotional offers, bonus notifications, and tournament announcements to members who have not opted out of marketing correspondence.

6 Legal Basis for Processing

6.1 win37 processes Personal Data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you accepted at registration — including account creation, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable anti-money-laundering regulations, tax reporting obligations, and responses to lawful requests from regulatory authorities.
• Legitimate interests: Processing carried out to pursue win37's legitimate business interests — including fraud detection, platform security, and service improvement — where those interests are not overridden by your data protection rights.
• Consent: Where processing is based on your consent (such as marketing communications), you retain the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7 Data Sharing & Disclosure

7.1 win37 does not sell, rent, or disclose your Personal Data to third parties for their own commercial or marketing purposes. Data is shared only in the following circumstances:

• Payment processors: Your financial data (bank account name, account number, e-wallet identifier) is shared with the relevant Indonesian payment processor solely to complete your deposit or withdrawal transaction. win37 does not store full bank account numbers beyond what is necessary for payment routing.
• KYC verification partners: Identity documents submitted for KYC are processed by our third-party verification partner to confirm your identity and age. Documents are transmitted over encrypted channels and are not retained by the verification partner beyond the completion of the verification process.
• Game studio providers: Technical session data (game ID, stake, outcome, timestamps) is transmitted to licensed game studios including Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft for game delivery and integrity auditing. No directly identifiable Personal Data beyond a pseudonymous player session token is shared with game studios.
• Fraud and security providers: IP addresses, device fingerprints, and behavioural data may be shared with fraud prevention platforms to identify and block suspicious activity across the industry.
• Legal and regulatory authorities: win37 will disclose Personal Data to law enforcement agencies, financial regulators, or courts when legally compelled to do so, or when we reasonably believe disclosure is necessary to protect the rights, property, or safety of win37, its members, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of win37's assets, Personal Data held in Member accounts may be transferred to the acquiring entity, subject to the same privacy commitments described in this policy.

8 International Data Transfers

8.1 win37's platform infrastructure is operated across data centres that may be located outside of Indonesia. As a result, your Personal Data may be transferred to and processed in jurisdictions other than your country of residence.

8.2 Wherever Personal Data is transferred internationally, win37 takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this policy. These safeguards include contractual data protection clauses with all third-party processors and selection of processors operating in jurisdictions recognised for adequate data protection standards.

8.3 By registering and using the Platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Indonesia as described in this clause.

9 Data Retention

9.1 win37 retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following indicative retention periods apply:

• Account and identity data: Retained for the lifetime of your active account, plus a minimum of five years following account closure to comply with anti-money-laundering obligations.
• Transaction and financial records: Retained for a minimum of five years from the date of each transaction.
• KYC documents: Retained for a minimum of five years following account closure or the completion of the relevant compliance review.
• Support communications: Retained for two years from the date of the last interaction, unless the communication is linked to an ongoing dispute or regulatory matter.
• Marketing preference records: Retained for the duration of your account and for one year following opt-out, to demonstrate compliance with your marketing preferences.
• Responsible gaming records: Self-exclusion and limit-setting records are retained for a minimum of five years to ensure that requests are honoured and to support any regulatory audit.
• Technical and usage logs: Retained for up to 24 months on a rolling basis, then anonymised or deleted.

9.2 Following the expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents recovery or re-identification.

10 Data Security

10.1 win37 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and win37's servers.
• Encryption at rest for all databases containing Personal Data and financial records.
• Role-based access controls ensuring that only authorised win37 personnel can access Personal Data, and only to the extent necessary for their job function.
• Multi-factor authentication requirements for internal systems that handle Member data.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Intrusion detection systems and 24/7 automated monitoring of platform infrastructure for anomalous activity.
• Formal incident response procedures including notification timelines for material data breaches.

10.2 Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to the rights and freedoms of affected individuals, win37 will notify affected members without undue delay and take immediate remedial action.

10.3 You are responsible for maintaining the security of your own account credentials. win37 strongly recommends using a unique, strong password for your account and enabling any additional security features available in your account settings. Do not share your login credentials with any other person.

11 Cookies & Tracking Technologies

11.1 win37 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to maintain your session, and to gather aggregate analytics data that helps us improve the user experience.

11.2 The following categories of cookies are used on the Platform:

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that keep you logged in and security cookies that help prevent cross-site request forgery. These cannot be disabled without impairing core functionality.
• Functional cookies: Remember your preferences such as language, display settings, and last-used payment method to provide a more personalised experience on return visits.
• Analytics cookies: Collect aggregate, anonymised data on how members navigate the Platform — which pages are visited most frequently, where users drop off in the deposit flow, and similar metrics. This data is used internally to improve the platform. win37 does not share analytics data with advertising networks.

11.3 win37 does not use third-party advertising cookies, tracking pixels for retargeted advertising, or any technology that tracks your behaviour across external websites.

11.4 You can manage or block cookies through your browser's settings at any time. Note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. Disabling functional or analytics cookies will not prevent you from accessing the Platform but may reduce the quality of your experience.

12 Your Data Rights

12.1 win37 respects your rights in relation to your Personal Data. Depending on your circumstances, you may have the following rights:

• Right of access: You may request a copy of all Personal Data we hold about you. We will provide this within 30 days of a verified request.
• Right to rectification: If any Personal Data we hold is inaccurate or incomplete, you may ask us to correct it. Identity data corrections require re-submission of updated identity documents.
• Right to erasure: You may request that we delete your Personal Data. This right is subject to our legal obligation to retain certain records for the periods described in Section 9. We will delete all data not subject to a mandatory retention period within 30 days of a verified erasure request.
• Right to restrict processing: You may ask us to restrict the processing of your data in certain circumstances — for example, while a rectification request is under review.
• Right to data portability: You may request that we provide your Personal Data in a structured, machine-readable format so that you can transfer it to another service provider.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• Right to object: You may object to processing based on win37's legitimate interests, including direct marketing. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.

12.2 To exercise any of these rights, contact win37's support team at [email protected] with the subject line "Data Rights Request". We will verify your identity before processing the request. We do not charge a fee for exercising your data rights unless a request is manifestly unfounded or excessive.

13 Protection of Minors

13.1 The win37 Platform is strictly intended for individuals who are 21 years of age or older. win37 does not knowingly collect Personal Data from persons under the age of 21.

13.2 If win37 discovers or is notified that Personal Data belonging to a person under 21 has been collected, we will promptly close the relevant account, delete or anonymise the data to the extent permitted by applicable law, and return any real-money balance to the verified payment source.

13.3 If you are a parent or guardian and believe that a person under 21 in your care has registered an account or submitted Personal Data to win37, please contact us immediately at [email protected] so that we can take appropriate action.

14 Policy Amendments

14.1 win37 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. The "Last Updated" date at the top of this page indicates the most recent revision.

14.2 Where changes are material — meaning they affect the scope of data collected, the purposes for which it is processed, or your data rights in a significant way — win37 will notify registered members via the email address on file at least 14 days before the changes take effect.

14.3 Continued use of the Platform after the effective date of any amendment constitutes your acknowledgement and acceptance of the revised Privacy Policy. If you do not agree to the revised policy, you should cease using the Platform and contact support to close your account.

14.4 The current version of this Privacy Policy is always available at win37.bio/privacy-policy. We encourage you to review it periodically.

15 Contact Us

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the way win37 handles your Personal Data, please contact our support team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data requests: "Data Rights Request" or "Privacy Enquiry"
• Support hours: 24 hours a day, 7 days a week (WIB, UTC+7)
• Languages: English and Indonesian

15.2 win37 commits to acknowledging all Privacy Policy enquiries within 48 hours (WIB business hours) and providing a substantive response within 14 calendar days. For complex data access or erasure requests, this period may be extended to 30 days, and we will notify you of any extension.

15.3 For questions relating to responsible gaming, self-exclusion, or deposit limit requests, please visit our Responsible Gaming page for dedicated guidance and contact options.